curl -vLk https://api.github.com/rate_limit
* Connected to api.github.com (22.214.171.124) port 443 (#0)
The IP address is correct.
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
This means a recent TLS stack is used which supports TLS 1.3. The output is typical to an OpenSSL backend of curl. Looks good so far.
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
This error message is in most cases misleading. I suspect that there is something in your network which intercepts traffic and replies with a non-TLS answer, which then gets interpreted as TLS and thus an unexpected TLS version is found in the (non-TLS) reply.
The typical reasons for this are wrong proxy configuration, captive portals or similar in the network or firewalls blocking connections. Unfortunately nothing is known about the environment where you run this rasperry pi on, so it is hard to give more precise reasons. In any case the problem is very likely outside of your machine.
Edit: the provided packet capture reflects what I expected:
It can be seen that the reply to the TLS Client Hello is the following plain HTTP response:
HTTP/1.1 200 OK
Server: Jetty/4.2.x (Windows XP/5.1 x86 java/1.6.0_17)
<meta HTTP-EQUIV="REFRESH" content="0; url=http://192.168.68.1:80/shn_blocking.html?cat_id=56&mac=B827EBDA723E&domain=api.github.com">
This is a refresh based redirect to (probably) the router with a path of
/shn_blocking.html. Searching for this path on the internet suggest that this is a feature of some TP-Link router which can block web sites for parental control - see here about this feature of your specific router TP-Link Deco . Likely that you need to specifically exclude your rasperry pi in the router so that it gets unfiltered internet access.